CVE-2026-54911

Katalog CVE

CVSS 6.5 · Medium EPSS 0,37%

Kerentanan Improper Input Validation pada ultrajson project ultrajson. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.

Rincian

Terbit di NVD

22 Juni 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2 mitigasi · patch · advisory vendor
• https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf patch
• https://github.com/ultrajson/ultrajson/releases/tag/5.13.0 product · release notes